Pages

▼
Saturday, December 29, 2018

Parsing the Cozy Bear LNK File

›
November 2018 saw a Cozy Bear /APT29 campaign, discussed in FireEye's blog post regarding APT29 activity  (from 19 Nov 2018), as well as...
Friday, December 28, 2018

PUB File

›
Earlier this month, I saw a tweet that led me to this Trend Micro write-up regarding a spam campaign where the bad guys sent malicious MS P...
Wednesday, December 19, 2018

Hunting and Persistence

›
Sometimes when hunting, we need to dig a little deeper, particularly where the actor employs novel persistence mechanisms.  Persistence mec...
Tuesday, December 18, 2018

Updates

›
Based on some testing that Phill had done, I recently updated my Recycle Bin index file ($I*, INFO2) parser.  Since then, there have been s...
Saturday, November 24, 2018

Tool Testing

›
Phill recently posted regarding some testing that he'd conducted, with respect to tools for parsing Windows Recycle Bin files . From Ph...
Friday, November 23, 2018

Basic Skillz, pt II

›
Following my initial post on this topic, and to dove-tail off of Brett's recent post , I wanted to provide something of a consolidated ...
2 comments:
Tuesday, November 20, 2018

Basic Skillz

›
Based on some conversations I've had with Jessica Hyde and others recently (over the past month or so), I've been thinking a good b...
17 comments:
Saturday, November 17, 2018

Veteran Skillz

›
I had an interesting chat recently with a fellow Marine vet recently which generated some thoughts regarding non-technical skills that veter...
5 comments:
Tuesday, October 30, 2018

More Regarding IWS

›
IWS has been out for a short while now , and there have been a couple of reviews posted.  So far, it seems that there is some reticence to ...
3 comments:
Sunday, October 28, 2018

Updates

›
Book Discount While I was attending OSDFCon, I had a chance to (finally!) meet and speak with Jessica Hyde , a very smart and knowledgeable...
3 comments:
Saturday, October 20, 2018

OSDFCon Trip Report

›
This past week I attended the 9th OSDFCon ...not my 9th, as I haven't been able to make all of them.  In fact, I haven't been able t...
2 comments:
Sunday, October 07, 2018

Updates

›
IWS Folks have started receiving the copies of IWS they ordered, and folks like Joey and Mary Ellen have already posted reviews!  Mary E...
3 comments:
Sunday, September 23, 2018

First Review of IWS

›
The written first review of IWS comes from Joey Victorino, a consultant with the IBM X-Force IRIS team.  Joey sent me his review via Linked...
Tuesday, September 18, 2018

Book Writing

›
With the release of my latest book, Investigating Windows Systems , I thought that now would be a good time to revisit the topic of writing ...
3 comments: